IP-FLASH `Goner' worm invades e-mail inboxes in Outlook* or ICQ/IRC

[David Farber <dave () farber net>]

BY KAMIKA DUNLAP
Mercury News
A new computer worm invaded corporate and personal e-mail inboxes Tuesday, 
sending antivirus companies scrambling to guard against the attack that 
came disguised as a friendly message about a new screen saver.
The worm, nicknamed ``Goner'' by antivirus companies, spreads through 
e-mail sent in Microsoft Outlook or Outlook Express and through ICQ 
instant-messaging and Internet Relay Chat programs. It can delete critical 
security files and antivirus programs.
``Everyone who gets it becomes more vulnerable,'' said Sam Curry, a 
spokesman for Santa Clara-based McAfee.com, an antivirus software maker. 
``It's damaging to the immune system of the Internet.''
Antivirus companies began receiving reports early Tuesday about the worm, 
which was believed to have originated in Europe. Estimates on the number of 
infected computers ranged from the tens of thousands to the hundreds of 
thousands, although some experts said the rate of spread was slowing as 
repair files or patches became available throughout the day.
The Goner worm arrives as an e-mail message with the subject line ``Hi'' 
and text that reads ``How are you? When I saw this screen saver, I 
immediately thought about you.''
If a user opens the attachment expecting a screen saver, the worm program 
infects the computer and sends a copy of itself to the user's e-mail and 
instant-messaging buddy lists. It also deletes security programs.
Large Silicon Valley companies, long accustomed to dealing with such 
invaders, were generally well prepared for the outbreak.
``Our antivirus team is working on it with a stringent procedure,'' said 
Chuck Mulloy, a spokesman for Intel. ``So far it has not impacted our 
business or productivity.''
But some small businesses were hit hard, along with some individual users 
who thought they were savvy enough to avoid such problems.
``I never open my mail without reading it first,'' said Ellen McGowan of 
Sportsline.com, an online sports service who unwittingly got the Goner worm 
and sent it on to others.
``I was on the instant messenger and my `you've got mail' thing came up,'' 
she explained. ``It happened so fast. It's like it did it by itself. It was 
really scary.''
McGowan said the infection caused about a half-hour of down time while her 
computer was being debugged.
Kathy Thibodeaux, chief executive of the landlord trade group Tri-County 
Apartment Association, was tricked by the friendly greeting.
``It said `hi,' '' she said. ``I thought it was a joke so I clicked on it.''
The worm spread to everyone in her address book, including a staff of 19 in 
her office. Her company's server computer was shut down for two hours, she 
said. ``It's been devastating for work productivity.''
Bill Walsh, president of San Jose real estate firm Cornish & Carey 
Commercial, had a similar experience.
``It got us pretty thoroughly and we tried to clean it up quickly,'' he 
said. He said the worm definitely affected the day's productivity.
``I'm spending a large part of the day apologizing'' to people he 
inadvertently infected, Walsh said.
Information on detecting and dealing with the virus was available from many 
sources, including Microsoft (http://office.microsoft.com/) and antivirus 
companies including Symantec (www.symantec.com), McAfee.com 
(www.mcafee.com) and Trend Micro (www.trendmicro.com).
``It's getting close to a point where it's under control,'' said Barbara 
Woolf, a spokeswoman for Trend Micro in Cupertino. ``Once we get a fix out 
there for it, it helps a lot.''
Computer experts advise both corporate and home users to upgrade their 
virus software at least weekly and not to open e-mail attachments from 
unknown senders.

Contact Kamika Dunlap at kamika.dunlap () sjmercury com or (408) 920-5501.